{"record":{"id":"37bf11f659aafb98","repo":"continuedev/continue","slug":"secretaccesskey-is-required-for-bedrock-api-only","errorCode":null,"errorMessage":"secretAccessKey is required for Bedrock API. Only found accessKeyId","messagePattern":"secretAccessKey is required for Bedrock API\\. Only found accessKeyId","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/openai-adapters/src/apis/Bedrock.ts","lineNumber":72,"sourceCode":"/**\n * Interface for tool use state tracking\n */\ninterface ToolUseState {\n  toolUseId: string;\n  name: string;\n  input: string;\n}\n\nexport class BedrockApi implements BaseLlmApi {\n  constructor(protected config: BedrockConfig) {\n    if (config.env?.accessKeyId || config?.env?.secretAccessKey) {\n      if (!config.env?.accessKeyId) {\n        throw new Error(\n          \"accessKeyId is required for Bedrock API. Only found secretAccessKey\",\n        );\n      }\n      if (!config.env?.secretAccessKey) {\n        throw new Error(\n          \"secretAccessKey is required for Bedrock API. Only found accessKeyId\",\n        );\n      }\n    }\n  }\n\n  async getCreds() {\n    if (this.config?.env?.accessKeyId && this.config?.env?.secretAccessKey) {\n      return {\n        accessKeyId: this.config.env.accessKeyId,\n        secretAccessKey: this.config.env.secretAccessKey,\n      };\n    }\n    const profile = this.config.env?.profile ?? \"bedrock\";\n    try {\n      return await fromNodeProviderChain({\n        profile: profile,\n        ignoreCache: true,","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/continuedev/continue/blob/5522c6f44ca0ac3528b37244818fbfa39b5af470/packages/openai-adapters/src/apis/Bedrock.ts#L54-L90","documentation":"The Bedrock adapter's credential pairing guard: if config.env contains accessKeyId, secretAccessKey must also be set, otherwise the constructor throws. This prevents the AWS SDK from attempting requests with a half-configured static credential set, which would otherwise surface as cryptic signing errors.","triggerScenarios":"Constructing BedrockApi with config.env.accessKeyId set but config.env.secretAccessKey missing or empty.","commonSituations":"Secret redaction tooling stripping the secret but leaving the ID; env var name mismatches (SECRET_ACCESS_KEY vs secretAccessKey); partial secret rotation.","solutions":["Add the missing secretAccessKey next to accessKeyId in config.env","If you intended to use IAM roles or an AWS profile, remove accessKeyId entirely so the SDK credential chain is used","Verify the secret was loaded (not undefined/empty string) from your secret manager"],"exampleFix":"// before\n{ provider: 'bedrock', env: { accessKeyId: 'AKIA...', region: 'us-east-1' } }\n\n// after\n{ provider: 'bedrock', env: { accessKeyId: 'AKIA...', secretAccessKey: 'wJalr...', region: 'us-east-1' } }","handlingStrategy":"validation","validationCode":"const env = config.env ?? {};\nif (env.accessKeyId && !env.secretAccessKey) {\n  throw new Error('secretAccessKey missing: provide both AWS keys or neither (use IAM role)');\n}","typeGuard":"const hasCompleteBedrockCreds = (env?: BedrockEnv): boolean =>\n  Boolean(env?.accessKeyId && env?.secretAccessKey) ||\n  (!env?.accessKeyId && !env?.secretAccessKey);","tryCatchPattern":"try { new BedrockApi(config); } catch (e) {\n  if (e instanceof Error && e.message.includes('secretAccessKey is required')) {\n    // load secret from secret manager and retry construction\n  }\n  throw e;\n}","preventionTips":["Assert both keys are non-empty strings at config load time","Add a startup health check that constructs the Bedrock client before serving traffic"],"tags":["bedrock","aws","credentials","config"],"backgroundTag":"incomplete-credentials","analyzedSha":"5522c6f44ca0ac3528b37244818fbfa39b5af470","analyzedAt":"2026-08-27T11:28:54.683Z","schemaVersion":2},"datasetVersion":"2026-08-27T13:17:12.746Z"}